Attacking JWT - Header Injections

Key Takeaways

welcome back to another video now this is a follow-up from my previous cracking Json web tokens video and you don't necessarily need to have watched it but it does cover the foundations of what a Json web token is if you're unfamiliar with them now today we're going to look at two attacks both targeting the header of our jwts as always if you enjoyed the video feel free to like And subscribe and let's dive in before we talk about header injection let's go a little bit deeper into the headers of a JWT the only mandatory header is ALG according to the specification however we often see type in there and other things like key ID which we'll see later on in our first attack we're going to tamper with the alloc header itself but in the second we'll look at how we can inject other headers to cause the application to use a key that we provide rather than the one intended by the application the other headers that we might be interested in are Json webkey jwk Json webkey sets URL jku and the key ID kid Json webkeys are a data structure that represents a cryptographic key as expected it's used to sign a verified jwts and can have various properties like the key type and the algorithm the jku header is a URL that points to a Json web key set jwks which is like it sounds a set of jwks that can represent multiple keys this is really handy because often if we want to rotate Keys we can grab the latest public key from the specified URL and the key ID kid lets us specify the key we are looking for 4 from a Json webkey set so together these are used to manage and identify which keys to use when signing and verifying ajwt now I realize that's quite a lot to take in but we'll be looking at this in a little bit more detail in our second lab so going back to our first attack on the algorithm header we're going to modify the value to none and what this does is tell the application to not use an algorithm and essentially trust and decode the token with no verification now the testing I did for this attack turned out to be pretty interesting as the packages I tested ended up handling the payload differently the two main packages I looked at were Json web token for node.js and Pi JWT which is a python Library commonly used in flask applications I can't say this for every package or scenario but both of these packages required me to specify the use of the none algorithm which was nice to see I'm sure there are some libraries out there that allow this Behavior by default also after getting the node.js version of my app handling the non-algorithm correctly I had to handle the secret differently because if you're using the ALG none then your key or secret needs to be null all in all it's actually a little annoying to write an application as vulnerable to the alcanon attack if you're using reputable up-to-date libraries in a normal way and this makes sense because I think this attack goes as far back as 2015 or at least it's listed under CV 2015 something something but as we walk through the code and you're like hey why is this setup to clearly be vulnerable to this attack by specifically allowing the non-algorithm in our algorithms list well now you know why because we have to just before we dive in I wanted to mention that it's still important to know about these kinds of attacks because they may still come up from time to time for example in Legacy applications or if two systems are integrated and maybe one Dev team doesn't want to share the secret or key with another Dev team but still want to process tokens from a third-party application in this instance they may allow for non-signed tokens without thinking about how that would impact other tokens that are sensitive to being tampered with or you could simply be doing a CTF all good reasons for knowing this technique let's take a quick look at our sample application for the first attack all right so we have our application here so we can ignore lines one four and five because this is just Express which is going to make rooting and things like that a little bit easier but not integral to the application or the attack we're trying to demonstrate line two is important however as we're importing the Json web token library and assigning this to JWT so every time you see JWT dot something you know that we're using the Json web token Library like down here so JWT DOT sign for example on line seven we're defining the secrets so please like And subscribe of course and this is asymmetric secret so this is going to be used to encrypt and decrypt or sign and verify our token I will at some point dive into hmax and asymmetric encryption and using public and private keys for Json web tokens probably something for another video now on line 9 we have our I get slash JWT endpoints so we just Define a payload obviously here this would be the logic of your application building the payload and then we have cons token equals JWT DOT sign and we're going to include the payload and use the secret to sign it and we're going to use the algorithm HS 256 and then we simply return this token now next up you can see a load of code that I've commented out and this is my original code that I thought would work so I thought basically all that I needed to do to include none in the algorithm is to include it in my algorithms list but this ended up to not be the case so I have app.post verified JWT and then we grab the token from the request body and then we do jwt.flarify pass in the token the secrets and the allowed algorithms and then if it's all good we return valid token if there's an error we return invalid token this didn't work unfortunately so I had to rewrite this endpoints and if we scroll down from we can see from line 26 what's happened when you pass in a token with the algorithm none you're not allowed to pass in a defined key or secret so what I had to do is essentially the same thing but adds this code here which decodes the header so we have decoded header equals jwt.d code notice we're not verifying this we're just decoding and then what we're doing here is we're defining a new key and if the decoded header.algorithm is equal to none we set the key to null otherwise we set the key to Secrets which of course is defined up here on line 7. and this is just a ternary operator this does the exact same thing it was my original way of doing it but I thought this was a little bit easier to read because not everybody uses uh this style of development or the style of if statements but the output of line 29 and the output of line 30 to 35 is exactly the same basically so here we come to our decoded token we do our jwt.verify and we pass in the token and of course if the token uses the none algorithm this key is going to be set to none and if it's using hs256 it's going to be set to secrets and these are the allowed algorithms and then if it's valid we return a message saying valid token and hello decoded token.username otherwise we return invalid token so that's the application let's jump in and demo the attack all right so we're just gonna spin up our application so node app.js looks like we're running on three thousand and one and then all we're going to do is curl HTTP localhost 3001 and grab our token with Slash JWT so usually I think or at least in the last video I used JWT dot IO to decode and mess around with the token However unfortunately this isn't going to work because for some reason it doesn't support the none algorithm and if I try and do this manually we don't get a token back but this is okay we could also do this in in the terminal but it's a little bit easier to use online tools if we come to token.dev paste in our token here and then we can either edit it manually or just come to the none algorithm here and there is one little problem with this but we'll address that in a second so I'm just going to copy this and then go at our payload and then we want HTTP slash localhost 3001 JWT and I suspect the fact that we don't have a trailing dot is going to throw an error which it does it says cannot read properties of null different applications might behave slightly differently when passing Json web tokens but in this case we need our DOT and we get a valid token and let me just clear my screen and send this again so it's a little bit easier to see so we have valid token message hello user and what we can do with this is we can just in fact come back to this and demo that this works by just saying Alex and I only need the second part of this token because the first part is the header and that decoded separately or encoded separately with base64 paste this in and we have a valid token with the message Hello Alex so our attack is working as expected now I also want to kind of show this in burp Suite because bubsweet has a great extension called JWT editor or something like this we'll see in a second and it's a useful one for testing jwts instead of using the terminal or doing everything manually so let's grab a fresh token and root this through our proxy so curl HTTP slash local whoops post 3001 JWT and we're just going to do proxy http localhost or 8080 and we should see this pop up and if you do have this JWT editor Keys installed it automatically highlights requests and responses that have a Json web token present in green which is quite handy and what we can do is we're just going to grab this token and then we're going to send it to verify but again we're going to send it through the proxy oops t80 so we have our token message equals hello user and here you'll see that we have a new tab open and I'll just move myself out of the way for a second so we can see a bit better we have this Json web token tab so we can start interacting with this and same with this post you'll see the Json web token tab here as well if you don't have this installed by the way you can come to extensions the App Store search for JWT and it's this one JWT editor and then all we're going to do is we're going to send this post to the repeater with Ctrl r or you can right click Send to repeater and again you have this tab open here and there's a couple of ways to do this we can either just modify the information in here or we can just do the none signing algorithm and click that send it it's still valid and as you can see even though we don't have a signature we're still good to go now if you want to know a little bit more about interacting with jwts and burp Suites then there is a great article here on the web Security Academy and this tells you all about how to interact with Json web tokens with this web Suite plugin so super helpful if you want to go and check that out and this is actually where we want to be for our next attack so let's take a quick look at jwk header injection so with jwk header injection this is an attack that exploits the insecure handling of Json webkeys embedded in the JWT header now in a secure implementation the server should rely on a trusted source of public Keys such as a jwks endpoint to verify the token's signature however if the server accepts a jwk provided in the token Header by the clients we can craft a token with a custom jwk containing our public key and then we can sign the key with our private key that we control effectively forging a valid token so let's take a look at how we can do this and I've come to Port swiger Academy so I'm just going to access the lab here we are and I think we can come to my account and it gives us some credentials to log in and the objective of this lab so if the text is a little bit small is basically to access the admin panel so we have an account as Dina and Peter and we log ourselves in so what I'm going to do is I'm going to switch on our proxy and just hit refresh we can actually see that we have a token already and here we are we have the my accounts and everything with a Json web token detected is highlighted in green let's take a quick look and I'm just going to move myself out of the way so here you can see that we have this cookie session equals and this is our Json web token and you can see that it's quite long so we could go in and decode this but we don't need to we can just switch over to Json web token tab here and we can see all of the information that we need so in the header we've got a couple of things we've got the kit and the algorithm rs256 and we have the ISS which is portsmigger and the sub which is Vina so this is our username and before we carry on what we want to do is maybe just grab this and see if we can just grab the admin endpoints and see what it says so it says admin interface only accessible or only available if logged in as an administrator so we come back here and we can see this request here so what I'm going to do is I'm going to send this to the repeater and I'm just going to hit send and we have again the admin interface is only logged in if available as an administrator now to pull off this attack we actually need our own public private keys and we could generate these but it's much easier if we just come to JWT editor Keys you can see that I've already created some but let's just create a new one for the video and we do new RSA key and we'll select 2048 jwk and hit generate and then we'll just hit OK and you can see that this has been added to our list of keys now I'll come back to repeater and all we want to do is we want to come into attack and embed jwk so we're embedding a new header which is going to be our key and we can choose our key from the list both of these are RSA 2048 so either of them are okay but use the one that you generated click OK and you can see our headers have changed we have this new embedded jwk in the header so this isn't going to work just yet because we actually need to update the sub here so we're just going to update this to admin and unfortunately because I updated this after adding our key we need to re-add it because it's going to sign the token when we embed our jwk so obviously we've changed the token since we previously signed it hit okay and then hit send and we'll just come to render you probably need admin illustrator instead of admin so let's try this again embed jwk hit send and we get the admin interface which is what we want and I if I recall the objective is to delete one of the users so we need to delete the user Carlos so we can just come back into here find the URI for this so slash admin delete username equals Carlos copy this come back to our request and we can just update our request and hit send and we'll get a 302 found which is good follow the redirection and we can look down here for the congratulations Banner or we can hit render and we get congratulations you solved the lab which is great so that's it for today's video now there's still a lot more to look at and consider but I hope this gives you some insight into how we can attack Json web tokens I'll catch you next time